   (close-connection client-id))
 
 (defmethod ws-handler :frontend/unsubscribe [{:keys [client-id ?data ?reply-fn] :as req}]
-  (check-document-access (-> ?data :document-id) req :admin)
+  (check-document-access (-> ?data :document-id) req :read)
   (let [document-id (-> ?data :document-id)]
     (log/infof "unsubscribing %s from %s" client-id document-id)
     (close-connection client-id)

                         :session-uuid (UUID/fromString (get-in req [:ring-req :session :sente-id]))})))

(defmethod ws-handler :frontend/mouse-position [{:keys [client-id ?data] :as req}]
  (check-document-access (-> ?data :document/id) req :admin)
  (let [document-id (-> ?data :document/id)
        mouse-position (-> ?data :mouse-position)
        tool (-> ?data :tool)

    ;; These are interesting b/c they're read-only. And by "interesting", I mean "bad"
    ;; We should find a way to let the frontend edit things
    ;; TODO: only send this stuff when it's needed
    (when (has-document-access? document-id req :admin)
      (log/infof "sending permission-data for %s to %s" document-id client-id)
      (send-fn client-id [:frontend/db-entities
                          {:document/id document-id
                           :entities (map (partial permission-model/read-api (:db req))
                                          (filter :permission/cust-ref
                                                  (permission-model/find-by-document (:db req)
                                                                                     {:db/id document-id})))
                           :entity-type :permission}])

      (send-fn client-id [:frontend/db-entities
                          {:document/id document-id
                           :entities (map access-grant-model/read-api
                                          (access-grant-model/find-by-document (:db req)
                                                                               {:db/id document-id}))
                           :entity-type :access-grant}])

      (send-fn client-id [:frontend/db-entities
                          {:document/id document-id
                           :entities (map (partial access-request-model/read-api (:db req))
                                          (access-request-model/find-by-document (:db req)
                                                                                 {:db/id document-id}))
                           :entity-type :access-request}]))))

(defmethod ws-handler :frontend/fetch-touched [{:keys [client-id ?data ?reply-fn] :as req}]
  (when-let [cust (-> req :ring-req :auth :cust)]
